ci(release): publish a tag only from green CI, and re-drive by tag input

[rennf93]

Closes #49

The release workflow of guard-agent-ts re-gated at the tag (a tag-push trigger and tests at the tag), after the tag was already immutable, and a manual re-drive read the ref instead of an input. This mirrors Guard-Core/guard-core-rs#156: the release workflow runs no lint or test of its own.

• verify: resolves the tag from the release event or the manual tag input (^v[0-9]+\.[0-9]+\.[0-9]+$), checks it out, compares it to the package version(s), and requires the newest push run of ci.yml on that commit to have succeeded (it waits up to an hour).
• publish: checks the tag out explicitly, builds and publishes guardagent with provenance through npm trusted publishing, skipping a version already on npm. The tarball pack smoke moved from the release workflow into ci.yml (a new pack-smoke job), and ci.yml no longer filters push runs by path, so a docs-only tagged commit (v3.2.4 was one) still gets the run verify requires.

A re-drive is Actions > Release > Run workflow with the tag; it checks the tag out with master's fixed workflow. The tag-push trigger and the tests at the tag are gone.

Tested locally: actionlint clean (the only warnings are pre-existing and identical on master). I ran the CI check step against real commits: the latest release tag passes and a commit whose CI failed is refused. After merging I will dispatch the release with the current latest tag to prove the re-drive path; every package is already published, so publish skips.